Breach Intelligence

2,852

Total breached databases

In 2020, the online advertising platform Payad.me experienced a data breach, affecting approximately 425,000 users. Sensitive information, including usernames, email addresses, phone numbers, and password data (with salts), was exposed.
  • Date: 2020
  • Domain: payad.me
  • Category: E-commerce & Retail
  • Data: Email Addresses IP Addresses Names Passwords Usernames
  • Records: 426,252
  • Lines: 426,257
  • Size: 70.08 MB
  • Passwords: SHA-256 Salted, Unknown
In February 2020, the guitar tuition website TrueFire suffered a data breach which impacted 600k members. The breach exposed extensive personal information including names, email and physical addresses, account balances and unsalted MD5 password hashes.
  • Data: Balances Birthdates Email Addresses Names Passwords Phone Numbers Physical Locations Usernames
  • Records: 602,330
  • Lines: 602,331
  • Size: 221.42 MB
  • Passwords: MD5
  • Cracked: 97%
In October 2018, the site dedicated to posting naked photos and other erotica of wives Wife Lovers suffered a data breach. The underlying database supported a total of 8 different adult websites and contained over 1.2M unique email addresses. Wife Lovers acknowledged the breach which impacted names, usernames, email and IP addresses and passwords hashed using the weak DEScrypt algorithm. The breach has been marked as "sensitive" due to the nature of the site.
  • Data: Email Addresses IP Addresses Names Passwords Usernames
  • Records: 1,349,551
  • Lines: 1,349,553
  • Size: 92.67 MB
  • Passwords: DES
  • Cracked: 93%
In July 2020, Omaze, an online fundraising platform known for offering prize-based charity campaigns, experienced a data breach that affected approximately 2.7 million users. The compromised data included names, usernames, email addresses, geographic locations, genders, social profiles, and passwords.
  • Data: Email Addresses Genders Geographic Locations Names Passwords Social Profiles Usernames
  • Records: 2,792,947
  • Lines: 538
  • Size: 412.66 MB
  • Passwords: PHPass
  • Cracked: 3%
In April 2013, Dungeons & Dragons Online, an interactive video game, allegedly suffered a data breach that exposed nearly 1.6 million player accounts. The compromised data, reportedly traded on underground forums, included email addresses, dates of birth, and password hashes.
  • Data: Birthdates Email Addresses IP Addresses Passwords Site Activity Usernames
  • Records: 1,645,527
  • Lines: 1,645,529
  • Size: 128.08 MB
  • Passwords: vBulletin
  • Cracked: 95%
In February 2019, the "world’s Best Caller ID and Spam Blocking app" Truecaller suffered a data breach that impacted 286 million Indian users. The breach led to the exposure of data including Phone Numbers, Phone Carriers, Full names, Genders, Locations, Job Titles, Company Names, Email Addresses, Websites, Facebook IDs and Twitter Usernames.
  • Data: Company Information Email Addresses Genders Geographic Locations Job Information Names Phone Numbers Social Profiles Telecom Providers Websites
  • Records: 286,411,304
  • Lines: 286,413,805
  • Size: 33.33 GB
  • Passwords: No
In January 2020, the mobile app to "compare anything" Wishbone suffered another data breach which followed their breach from 2016. An extensive amount of personal information including almost 10M unique email addresses alongside names, phone numbers geographic locations and other personal attributes were leaked online and extensively redistributed. Passwords stored as unsalted MD5 hashes were also included in the breach.
  • Data: Birthdates Email Addresses Genders Geographic Locations IP Addresses Names Passwords Phone Numbers Profile Photos Security Credentials Social Profiles Usernames
  • Records: 40,295,205
  • Lines: 40,295,385
  • Size: 13.79 GB
  • Passwords: MD5
  • Cracked: 0%

Frequently Asked Questions

A data breach is unauthorized access to data (often involving account takeover, malware, or misconfigured infrastructure). A data leak is exposure of data due to mistakes like public cloud storage, open databases, or accidental publishing. A database dump is a packaged dataset that may come from a breach, leak, scraping, or aggregation.

Change passwords for any affected accounts immediately, prioritizing email, banking, and any account that shares the same password. Enable multi-factor authentication wherever possible. Monitor your accounts for suspicious activity and consider placing a fraud alert or credit freeze if financial data was exposed.

Start with containment and verification: confirm what data was exposed, identify the entry point, rotate credentials (especially SSO, VPN, email), and enforce MFA. Then investigate affected systems, notify stakeholders as required, and harden controls to prevent recurrence. A structured incident response plan helps keep the work measurable and compliant.

Dark web monitoring helps you spot exposure signals early — before stolen data is widely reused for account takeover or targeted attacks. Monitoring complements vulnerability management by revealing when attackers already have leverage. Pair it with continuous attack surface monitoring and strong Asset Discovery to reduce blind spots.

Not always. Some datasets are old, incomplete, or derived from third parties. However, any exposure increases risk because credentials and personal data can be reused indefinitely. Treat it as a priority signal: rotate credentials, enforce MFA, review suspicious logins, and audit the systems that could have produced the data.

SynScan helps you connect the dots between attack surface exposure, vulnerabilities, and breach signals so you can prioritize remediation and reduce the chance of repeat incidents.